Search

Begin New Search Topic Cybersecurity Publication Year within 5 Years

71. THE LIMITS OF PLAUSIBLE DENIABILITY IN UKRAINE AND BEYOND

Author:
Costantino Pischedda and Andrew Cheon
Publication Date:
06-2023
Content Type:
Commentary and Analysis
Institution:
Political Violence @ A Glance
Abstract:
Drone strikes targeted Moscow last week. Though much remains unknown about it, the episode appears to be part of a series of unclaimed coercive attacks that US officials attributed to Ukrainian government personnel, including the killing of the daughter of a Russian nationalist, the sabotage of the North Stream pipelines, and drone attacks on the Kremlin. With unclaimed coercion, perpetrators impose costs on adversaries to signal their resolve to prevail in disputes while denying involvement or simply not making any claim about responsibility. Unclaimed coercion is not unique to the war in Ukraine. Russia launched cyber attacks in 2007 to extract concessions from Estonia, though Moscow denied responsibility, and in 2010 Seoul claimed North Korea torpedoed a South Korean warship, Pyongyang’s denial notwithstanding. Unclaimed coercion may have strategic benefits. Without unmistakable evidence about the identity of the perpetrator, the absence of a claim of responsibility creates plausible deniability, which, some argue, allows coercers to send intelligible, credible messages to targets while containing escalation risks. It may also reduce the costs of being seen as a norm violator. For instance, Austin Carson observed that, though both Saudi Arabia and the United States viewed the 2019 attacks on Saudi oil facilities as part of an Iranian coercive campaign, the absence both of conclusive evidence and a claim of responsibility prevented Riyadh and Washington from carrying out a tough military response, which would have looked “illegitimate while jeopardizing allies’ support.”
Topic:
Infrastructure, Cybersecurity, Armed Conflict, Coercion, Russia-Ukraine War, and Plausible Deniability
Political Geography:
Russia, Ukraine, South Korea, North Korea, and Cuba

72. Waterloo Security Dialogue: Fostering Nationwide Cybersecurity Collaboration

Author:
Shelly Bruce, John Bruce, Aaron Shull, and Kailee Hilt
Publication Date:
10-2023
Content Type:
Special Report
Institution:
Centre for International Governance Innovation (CIGI)
Abstract:
On June 27 and 28, 2023, the Centre for International Governance Innovation (CIGI) hosted the Waterloo Security Dialogue (WSD). The conference brought together leaders and experts to establish connections across jurisdictions with the objective of improving cybersecurity information sharing and incident response in ways that will contribute to a stronger national culture of cybersecurity resilience. The conference revolved around three key themes: cyberthreat information sharing; cyber incident collaboration and coordination practices; and initiatives to enhance cyber resilience in Canada. These themes were explored through engaging panel discussions, keynote presentations and interactive sessions. This report presents key takeaways from the conference discussions. It does not aim to present a unanimous consensus among participants or reflect the views of any specific individual or organization. Rather, its primary objective is to lay out key challenges and ideas identified by participants — these will be explored further through CIGI-led workshops and subsequent WSDs.
Topic:
Security, Cybersecurity, Conference, Resilience, and Collaboration
Political Geography:
Canada and North America

73. China’s AI Regulations and How They Get Made

Author:
Matt Sheehan
Publication Date:
07-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
China is in the midst of rolling out some of the world’s earliest and most detailed regulations governing artificial intelligence (AI). These include measures governing recommendation algorithms—the most omnipresent form of AI deployed on the internet—as well as new rules for synthetically generated images and chatbots in the mold of ChatGPT. China’s emerging AI governance framework will reshape how the technology is built and deployed within China and internationally, impacting both Chinese technology exports and global AI research networks. But in the West, China’s regulations are often dismissed as irrelevant or seen purely through the lens of a geopolitical competition to write the rules for AI. Instead, these regulations deserve careful study on how they will affect China’s AI trajectory and what they can teach policymakers around the world about regulating the technology. Even if countries fundamentally disagree on the specific content of a regulation, they can still learn from each other when it comes to the underlying structures and technical feasibility of different regulatory approaches. In this series of three papers, I will attempt to reverse engineer Chinese AI governance. I break down the regulations into their component parts—the terminology, key concepts, and specific requirements—and then trace those components to their roots, revealing how Chinese academics, bureaucrats, and journalists shaped the regulations. In doing so, we have built a conceptual model of how China makes AI governance policy, one that can be used to project the future trajectory of Chinese AI governance (see figure 1). China’s three most concrete and impactful regulations on algorithms and AI are its 2021 regulation on recommendation algorithms, the 2022 rules for deep synthesis (synthetically generated content), and the 2023 draft rules on generative AI. Information control is a central goal of all three measures, but they also contain many other notable provisions. The rules for recommendation algorithms bar excessive price discrimination and protect the rights of workers subject to algorithmic scheduling. The deep synthesis regulation requires conspicuous labels be placed on synthetically generated content. And the draft generative AI regulation requires both the training data and model outputs to be “true and accurate,” a potentially insurmountable hurdle for AI chatbots to clear. All three regulations require developers to make a filing to China’s algorithm registry, a newly built government repository that gathers information on how algorithms are trained, as well as requiring them to pass a security self-assessment. Structurally, the regulations hold lessons for policymakers abroad. By rolling out a series of more targeted AI regulations, Chinese regulators are steadily building up their bureaucratic know-how and regulatory capacity. Reusable regulatory tools like the algorithm registry can act as regulatory scaffolding that can ease the construction of each successive regulation, a particularly useful step as China prepares to draft a national AI law in the years ahead. Examining the roots of these regulations also grants insight into the key intellectual and bureaucratic players shaping Chinese AI governance. The Cyberspace Administration of China (CAC) is the clear bureaucratic leader in governance to date, but that position may grow more tenuous as the focus of regulation moves beyond the CAC’s core competency of online content controls. The Ministry of Science and Technology is another key player, one that may see its profile rise due to recent government restructuring and increased focus on regulating underlying AI research. Feeding into this bureaucratic rulemaking are several think tanks and scholars, notably the China Academy for Information Communications Technology and Tsinghua University’s Institute for AI International Governance. In the years ahead, China will continue rolling out targeted AI regulations and laying the groundwork for a capstone national AI law. Any country, company, or institution that hopes to compete against, cooperate with, or simply understand China’s AI ecosystem must examine these moves closely. The subsequent papers in this series will dig into the details of these regulations and how they came about, deepening understanding of Chinese AI governance to date and giving a preview of what is likely coming around the bend.
Topic:
Foreign Policy, Science and Technology, Cybersecurity, Regulation, and Artificial Intelligence
Political Geography:
China and Asia

74. The sixth domain: The role of the private sector in warfare

Author:
Franklin D. Kramer
Publication Date:
10-2023
Content Type:
Special Report
Institution:
Atlantic Council
Abstract:
The United States and its allies have for some time recognized, as NATO doctrine provides, five operational domains—air, land, maritime, cyberspace, and space.1 Each of those arenas fully fits with the understanding of a domain as a “specified sphere of activity” and, in each, militaries undertake critical wartime actions. But in the ongoing Ukraine-Russia war, certain key operational activities have been undertaken by the private sector as part of the conduct of warfare.2 By way of example, private-sector companies have been instrumental both in providing effective cybersecurity and in maintaining working information technology networks. As part of such efforts, these firms have established coordinated mechanisms to work with relevant government actors. These operational and coordinated activities by the private sector demonstrate that there is a “sixth domain”—specifically, the “sphere of activities” of the private sector in warfare—that needs to be included as part of warfighting constructs, plans, preparations, and actions if the United States and its allies are to prevail in future conflicts. As will be elaborated below, that sphere of activities focuses mainly on the roles of information and critical infrastructures, including their intersections—ranging from the transmission and protection of information to the assurance of critical infrastructure operations. Many of the United States’ activities in the sixth domain will take place in the United States homeland. However, while “defending the homeland” is listed as the first priority in the 2022 National Defense Strategy, insufficient attention has been paid to the actions that will be required of the private sector beyond just the defense industrial base as part of accomplishing an effective defense.3 Likewise, when US military forces are engaged in overseas combat, private-sector companies in allied countries (as well as US companies operating overseas) will be critical for the effectiveness of US forces, as well as for the allies’ own militaries. In short, establishing an effective strategy for the private sector in warfare is a key requirement for the United States and its allies.
Topic:
Cybersecurity, Drones, Artificial Intelligence, Private Sector, Defense Industry, and Russia-Ukraine War
Political Geography:
Russia, Europe, Ukraine, and United States of America

75. The Economic Impacts of the Proposed EUCS Exclusionary Requirements: Estimates for EU Member States

Author:
Matthias Bauer and Philipp Lamprecht
Publication Date:
10-2023
Content Type:
Working Paper
Institution:
European Centre for International Political Economy (ECIPE)
Abstract:
The EU Agency for Network and Information Security (ENISA) is proposing a far-reaching “European Cybersecurity Certification Scheme for Cloud Services“ (EUCS) to be established in the European Union (EU). According to the latest draft of August 2023, leaked by Politico in September 2023, the proposed EUCS would by design prevent non-European vendors from providing “high assurance level” cloud services in the EU. In this study, we show that the proposed “immunity” requirements, i.e., foreign ownership and headquarter restrictions, local staff requirements, and data localisation would lead to significant losses in Member States’ aggregate economic activity and drive a big wedge between economic growth in the EU and the growth of non-EU economies. The projected losses in annual EU GDP will vary from EUR 610 billion to EUR 29 billion within approx. two years of implementation, contingent upon the specific sectoral coverage of high-assurance use cases under the cloud service evaluation level CS-EL4. The results fit into the overall picture of EU digital policy, which has weakened rather than strengthened the competitiveness of EU industries in the past. Our findings align with the broader impacts of EU digital policy, which runs the risk of exacerbating the growth gap and technology disparity between the EU and other advanced economies. Cloud services have become increasingly popular and integral to Europe’s economy. Cloud services are granting businesses of all sizes equal access to global data and resources, stimulating collaboration, and bolstering competitiveness. Advanced cloud services are levelling the playing field in domestic commerce and international trade. Smaller enterprises can harness advanced IT capabilities, particularly cloud-based supply chain management, to streamline their operations. Cloud computing solutions are also playing a crucial role in modernising public services, offering transformative potential for government administrations and service quality. Cloud services adoption is expected to grow substantially in the years ahead, driven by data analytics, AI applications as well as quantum and edge commuting solutions. The global cloud computing market is on a rapid growth trajectory and is expected to reach some EUR 2,080 billion by 2030. Industry forecasts indicate that cloud services and transversal cloud-based technologies like AI applications, quantum, and edge computing will experience consistent growth in innovation and are increasingly finding broader applications across various industries. Overall, the global market for IT services is highly competitive and dynamic, with global cloud service providers competing against a broad range of IT service providers of varying scale, including on-premises hardware vendors, private and co-located data centre providers and software providers. Despite showing a trade deficit in international cloud services trade, trade in ICT and digitally enabled services is not a one-way-street for the EU. Recent trade data reveals that the total value of EU exports in digital and digitally enabled services to the rest of the world is roughly equivalent to the total value of EU imports from the rest of the world. This balance in trade is also observed in EU digital trade with the US, where EU exports of ICT services to the US nearly match US exports of digital services to the EU. The proposed EUCS exclusionary requirements entail various negative consequences. As recognised by the European Commission’s latest progress report on digitisation in the EU, European companies have yet to reach the “Digital Decade” targets, especially when it comes to embracing cloud-supported technologies such as AI and big data, as the adoption of digital technologies remains significantly below these objectives.[1] Exclusionary requirements would create operational inefficiencies and increased production costs for cloud services providers and cloud adopters. They would undermine investments in the domestic economy, resulting in reduced international trade, competition, and innovation. The imposition of exclusionary requirements by the EU could create a domino effect of restrictions caused by retaliation and protectionism. Data localisation and nationality requirements stifle innovation and competition, particularly in data-driven industries. The creation of redundant capacities in the EU would have adverse environmental impacts, including increased energy consumption, land use, and electronic waste. Immunity requirements would increase rather than mitigate cybersecurity risks, creating a security deficit for EU cloud adopters that lose access to proven global risk detection and prevention solutions. This study provides estimates of potential GDP and industry output effects from the implementation of exclusionary requirements under the proposed EUCS framework.[2] It is shown that the strict “immunity” requirements in the EUCS cybersecurity certification framework would severely limit European customers’ access to advanced technologies, innovation and global ICT industry growth trends. The study’s findings highlight the significant economic consequences of potential restrictions on access to global cloud services across three scenarios of different sectoral coverage. It is shown that even in the least restrictive scenario, where “immunity” requirements would only be applied to a narrow spectrum of sectors and highly critical use cases, the reduction in the EU’s annual GDP could be substantial. In scenario 1 (broad critical sector coverage), reflecting political demands of the current French government, the EU’s annual GDP is projected to decrease by 3.9% when accounting for lost cloud capacities and forgone cloud capacity and productivity growth, within 2 years of implementation. For scenario 2 (medium critical sector coverage) and scenario 3 (narrow critical sector coverage), the estimated annual losses in GDP amount to -2% and -0.2%, respectively. In terms of current EU GDP, annual losses would amount to EUR 610 billion, EUR 317 billion, and EUR 29 billion, respectively, underscoring the significant magnitude of the potential impacts. For the broad critical sector coverage scenario, our results also show that the EU’s annual GDP losses accumulate over longer periods of time. After 5 years following the implementation of exclusionary EUCS requirements, the annual growth losses for the EU and its Member States remain significant. This is due to the inability of European businesses and the EU’s public sector to tap into the worldwide innovation and productivity gains offered by globally accessible technologies and services. For the EU, we estimate the annual GDP loss to be -3.6%, with a trend to further accumulate in subsequent years.
Topic:
Science and Technology, European Union, Cybersecurity, Digital Economy, and Digitization
Political Geography:
Europe

76. Australia's semiconductor manufacturing moonshot: securing semiconductor talent

Author:
Bronte Munro, Alex Capri, and Robert Clark
Publication Date:
11-2023
Content Type:
Special Report
Institution:
Australian Strategic Policy Institute (ASPI)
Abstract:
Semiconductors are a critical component in all modern technologies, from personal communication devices and medical devices to weapons systems. Crucial to producing semiconductors is the availability of a highly skilled workforce, managing clean-room facilities and highly specialised equipment to execute the hundreds of unique steps needed to manufacture a single wafer, depending on the complexity of the chip. ASPI’s 2022 report, Australia’s semiconductor national moonshot, laid out the strategic reasons why Australia must embark on a capacity-building initiative to create a homegrown semiconductor manufacturing ecosystem. Every item on the Australian federal government’s List of Critical Technologies in the National Interest is dependent on semiconductors. By committing to growing a semiconductor-manufacturing industry from a mature-process-scale baseline, policymakers would position Australia to manufacture chips relevant to the energy, transport, health, IT and defence sectors. Such an industry would enable Australia to execute long-term critical technology strategies in areas such as quantum computing and artificial intelligence, to mitigate supply-chain risk against disruption from conflict or natural disaster, and provide highly skilled jobs in affordable locations, enriching the Australian economy. It’s important to note that both AUKUS Pillar 2 and the Albanese government’s April 2023 publication of the Defence Strategic Review reflect a shift in Australia’s strategic thinking on defence and national security, and the important correlation and greater cooperation between industry, education and defence priorities, particularly when it comes to technology. Delivering on that shift will be difficult and often costly, but this report provides a series of recommendations of what that correlation and cooperation could look like. For Canberra, such an endeavour is of the same magnitude as America’s historic ‘moonshots’ during the 1960s and 1970s. It’s a once-in-a-generation challenge that will determine Australia’s place in the world, and human capital is central to ensuring success. Opting out of semiconductor manufacturing for the long term would severely constrain Australia’s growth as a technological nation and consign it to second-tier status. This report expands on the recommendations made in the 2022 ASPI report for establishing a semiconductor-manufacturing capability in Australia and focuses on the importance of creating a talent pipeline that can support a scaled industry. Achieving a semiconductor moonshot requires stepping up Australia’s very respectable semiconductor device fabrication R&D to industry-compatible prototyping via a dedicated facility, together with attracting (through that capability and by government incentives) a semiconductor manufacturer to locate a mature-process-scale foundry in Australia—which will require support from an upskilled Australian talent pipeline. This is an ambitious move but is an essential step in growing such a capability. The ability to grow and maintain a high-skilled workforce is a foundational challenge for Australia that can be addressed through close examination of trailblazing public–private partnerships (PPPs) that aim to provide talent-pipeline security in the US, Taiwan and Japan. Australian governments, industry and academia can emulate and engage with the examples highlighted through case studies in this report to attract semiconductor industry investment, boost talent-pipeline development and strengthen industry R&D. Australia’s states and territories all have varied capacity to o›er support to a semiconductor-manufacturing capability.
Topic:
Cybersecurity, Manufacturing, Artificial Intelligence, Emerging Technology, and Semiconductors
Political Geography:
Australia

77. The Strategic Nature of the Digital Age

Author:
Michael Fischerkeller and Richard Harknett
Publication Date:
09-2023
Content Type:
Journal Article
Journal:
Brown Journal of World Affairs
Institution:
Brown Journal of World Affairs
Abstract:
Cyber operations advance intelligence goals through their capacity to surveil populations at home and abroad, as well as propagate new forms of informa- tional manipulation and communication. But what if those outcomes are only a subset of cyberspace’s potential impact on the conduct of international relations? Political scientist James Rosenau posits that the role of academic theory is fun- damentally to ask and posit answers to the “what ifs” of complex phenomena.1 In our book, Cyber Persistence Theory: Redefining National Security in Cyberspace, co-authored with Dr. Emily Goldman, we examine state activ- ity in and through cyberspace and conclude that it is strategic in potential and intent. There are two fundamental reasons why this focus on strategic potential is important. First, if the emerging field of cyber security studies is to mature, it needs to illuminate the underlying patterns emerging in modern international relations. Second, state policies should reinforce an overall stabilizing dynamic across international security relations as they increase their use of cyber and cyber-enabled operations and campaigns. In both cases, study and policy must be based on an accurate understanding of the logic of cyberspace security. States could focus on a narrow subset of cyber activity, such as traditionally framed propaganda, surveillance, and intelligence, in isolation of its capacity to shift power. However, such exclusion of the numerous other ways cyberspace can be leveraged effectively advances neither the academic nor policy objective.
Topic:
Security, Intelligence, Science and Technology, and Cybersecurity
Political Geography:
Global Focus

78. The Weight of History: Challenges for Police in the Governance of Cybercrime in Spain

Author:
Cristina Del Real
Publication Date:
12-2023
Content Type:
Journal Article
Journal:
Journal on International Security Studies (RESI)
Institution:
International Security Studies Group (GESI) at the University of Granada
Abstract:
El cibercrimen presenta diversos desafíos para la policía, incluyendo la complejidad y globalidad de las acciones criminales, la dificultad de rastrear el ciberespacio y la constante evolución de estas actividades delictivas. A través del marco conceptual de institucionalismo histórico y discursivo, este artículo explora los retos de la policía en la gobernanza del cibercrimen en España. El artículo destaca la importancia de situar la policía en el contexto del sistema de gobernanza de la ciberseguridad para comprender sus desafíos y adaptaciones. A través del análisis de 36 documentos clave, se argumenta que los orígenes y la evolución de las políticas de ciberseguridad se fundamentaron en narrativas centradas en la protección de la información y el incremento de la confianza de la sociedad en las tecnologías digitales, ambas narrativas alejadas del discurso centrado en la ciberdelincuencia. El estudio de caso en España enriquece la literatura sobre gobernanza de la ciberseguridad al explorar cómo la evolución histórica y las narrativas impactan en la posición de los actores involucrados en el sistema de gobernanza.
Topic:
Crime, Governance, Cybersecurity, Institutionalism, and Police
Political Geography:
Europe and Spain

79. The Anatomy of Cyber Risk

Author:
Rustam Jamilov, Hélène Rey, and Ahmed Tahoun
Publication Date:
05-2023
Content Type:
Working Paper
Institution:
Institute for New Economic Thinking (INET)
Abstract:
This paper employs computational linguistics to introduce a novel text-based measure of firm-level cyber risk exposure based on quarterly earnings conference calls of listed firms. Our quarterly measures are available for more than 13,000 firms from 85 countries over 2002-2021. We document that cyber risk exposure predicts cyber attacks, affects stock returns and profits, and is priced in the equity option market. The cost of option protection against price, variance, and tail risks is greater for more cyber-exposed firms. Cyber risks spill over across firms and persist at the sectoral level. The geography of cyber risk exposure is well approximated by a gravity model extended with cross-border portfolio flows. Back-of-the-envelope calculations suggest that the global cost of cyber risk is over $200 billion per year.
Topic:
Economics, Markets, Cybersecurity, Business, and Risk
Political Geography:
Global Focus

80. Mapping Cyber-related Missile and Satellite Incidents and Confidence-building Measures

Author:
Lora Saalman, Larisa Saveleva Dovgal, and Fei Su
Publication Date:
11-2023
Content Type:
Commentary and Analysis
Institution:
Stockholm International Peace Research Institute (SIPRI)
Abstract:
Cyber incidents that—whether due to human error, system malfunction or intentional targeting—impact satellite and missile systems extend beyond the ongoing war in Ukraine. These systems are essential to civilian and military operations and disrupting them has the potential to elicit conventional or even nuclear retaliation. Due to the centrality of satellite and missile-related infrastructure, cyber incidents impacting the functionality of such infrastructure have served as a catalyst for previous confidence-building measures (CBMs) that may provide a template for future ones. This paper builds on SIPRI work to map cyber-related missile and satellite incidents, as well as unilateral, bilateral and multilateral CBMs to provide takeaways meant to foster greater predictability and stability in cyberspace.
Topic:
Cybersecurity, Weapons, Cyberspace, Confidence Building Measures, and Russia-Ukraine War
Political Geography:
Ukraine and Global Focus